T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and immediately execute their contents using Bash or PowerShell. Neither installation path pins a version, verifies a cryptographic signature or checksum, saves the script for inspection, nor requires approval immediately before execution. HTTPS provides transport protection but does not establish that the retrieved script is safe. The effective code can change after the Skill is reviewed. Compromise of the hosting service, DNS or delivery infrastructure, deployment credentials, or the installation script itself could therefore turn these instructions into an arbitrary-code-execution channel. Although the instructions are presented as a fallback after an `oo: command not found` error, automatic software installation exceeds the minimum privileges needed for the Skill's declared read-only Elevio operations. The Skill can instead stop and direct the user to a verifiable manual installation process. The declared tool restriction, `Bash(oo *)`, also does not authorize direct `curl`, `bash`, or PowerShell installer execution, making these setup instructions inconsistent with the stated least-privilege tool boundary. ### Attack Path 1. A user submits an Elevio-related request and the Skill attempts to invoke the `oo` CLI. 2. The command fails because the CLI is not installed. 3. The Agent or user follows the documented first-time setup fallback. 4. `curl` or `Invoke-RestMethod` retrieves a mutable script from `cli.oomol.com`. 5. The response is passed directly to Bash or `Invoke-Expression` withou ...[truncated 1013 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands from the Skill instructions. 2. Do not let the Skill automatically install missing system tools. Stop execution and ask the user to complete installation through an independently documented process. 3. Link to an official, version-specific release rather than a mutable generic installation endpoint. 4. Download the installer or package to disk without executing it. 5. Verify a vendor-published cryptographic signature or a pinned SHA-256 checksum obtained through a separately trusted channel. 6. Allow inspection of the downloaded artifact before execution. 7. Require explicit user approval before running any installer, and display the exact artifact, version, source, and expected effects. 8. Prefer a signed native package distributed through a trusted package manager with version pinning and provenance verification. 9. Run installation with standard-user privileges unless a specific, documented operation requires elevation. 10. Keep setup behavior consistent with the declared `Bash(oo *)` tool restriction; direct installer execution should not be added to the Agent's permitted commands.